N-able N-central RCE flaw actively exploited
A pre-auth remote code execution flaw in N-able N-central (CVE-2026-86218, CVSS 10.0) is being actively and successfully exploited in the wild.
NCSC-NL issued a high-priority advisory for a critical static code injection vulnerability in N-able N-central, a widely used remote monitoring and management (RMM) platform, affecting all on-premises installations running versions prior to 2026.3.1.14. The flaw allows an unauthenticated remote attacker to execute arbitrary code on the affected system with no authentication required, making it a fully pre-auth RCE with a maximum CVSS v4 score of 10.0.
N-able initially reported exploitation attempts and has since confirmed successful exploitation against customers, indicating this moved from attempted to confirmed compromise. N-able is actively investigating incidents and working directly with affected customers. Given N-central's role as centralized management infrastructure for MSPs and IT departments, successful compromise could provide attackers a foothold to pivot into managed client environments, making this a significant supply-chain-adjacent risk.
On-premises customers are urged to upgrade immediately to N-central 2026.3 HF4. Hosted (NCOD) instances have already been patched by N-able and require no customer action. Defenders running on-premises N-central should prioritize patching, review N-able's published IoCs, and investigate for signs of prior exploitation given confirmed in-the-wild attacks.
Mentioned in this report
Detection guidance
N-able N-central Unauthenticated Code Injection
Detects HTTP requests to N-central endpoints with suspicious payload patterns indicative of code injection attempts targeting the pre-auth RCE vulnerability. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: N-able N-central Unauthenticated Code Injection
description: Detects HTTP POST/GET requests to N-central application endpoints containing
code injection payloads (script tags, command delimiters, or encoded executable
content) without prior authentication, targeting CVE in N-central RMM platform.
tags:
- attack.t1190
logsource:
category: web_shell
product: webserver
detection:
selection:
cs_uri_stem|contains:
- /api/
- /servlet/
- /platform/
cs_method:
- GET
- POST
cs_body|re: (<script|javascript:|on\w+\s*=|cmd\.exe|powershell|\$\(|`|eval|exec)
cs_username|exists: false
filter_patch_check:
cs_uri_stem|contains:
- /version
- /status
- /health
condition: selection and not filter_patch_check
falsepositives:
- Legitimate monitoring tools sending telemetry payloads with encoded content
- Plugin/extension updates that contain binary or base64 content in request bodies
level: critical
id: 433d8863-ce5c-5212-bc75-a9dd5e1a516a
status: experimental
author: Vorant
N-central Suspicious Process Execution from Application Pool
Detects N-central application process spawning system command interpreters or reconnaissance tools without legitimate administrative context. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: N-central Suspicious Process Execution from Application Pool
description: Detects N-central W3WP or related application pool processes spawning
cmd.exe, powershell.exe, or system reconnaissance utilities - indicative of post-exploitation
code execution via the pre-auth RCE vulnerability.
tags:
- attack.t1190
- attack.execution
logsource:
category: process_creation
product: windows
detection:
selection:
ParentImage|re: (?i)(w3wp\.exe|iisexpress\.exe|ncentral.*service)
Image|endswith:
- \cmd.exe
- \powershell.exe
- \whoami.exe
- \ipconfig.exe
- \tasklist.exe
- \systeminfo.exe
filter_maintenance:
CommandLine|contains:
- type NUL
- echo
- REM
User|contains: SYSTEM
condition: selection and not filter_maintenance
falsepositives:
- Legitimate administrative scripts or monitoring integrations within N-central
- Scheduled maintenance tasks executing diagnostic commands
level: high
id: 27d36ee0-5600-53fe-b2f6-eb70121b9d30
status: experimental
author: Vorant
N-central Abnormal Outbound Network Activity from Service Process
Detects N-central service processes initiating unexpected network connections to unusual ports or external hosts, consistent with post-exploitation C2 or lateral movement. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: N-central Abnormal Outbound Network Activity from Service Process
description: Detects N-central W3WP or application processes establishing outbound
network connections to non-standard ports (not 80, 443, 53) or suspicious remote
hosts after successful code injection.
tags:
- attack.t1190
- attack.command-and-control
logsource:
category: network_connection
product: windows
detection:
selection:
Image|re: (?i)(w3wp\.exe|iisexpress\.exe|ncentral.*service)
Initiated: 'true'
filter_internal:
DestinationIp|cidr:
- 10.0.0.0/8
- 172.16.0.0/12
- 192.168.0.0/16
filter_selection_excluded:
DestinationPort:
- 80
- 443
- 53
- 123
- 25
- 587
- 3306
- 5432
condition: (selection and not filter_selection_excluded) and not filter_internal
falsepositives:
- Database replication to custom ports on remote servers
- Third-party plugin communications to legitimate cloud services
level: high
id: e502318a-52c9-53b4-ab77-1802a84d89f8
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://advisories.ncsc.nl/2026/ncsc-2026-0342.html
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free